Original release date: November 12, 2001
Last revised: May 30, 2002
A complete revision history can be found at the end of this file.
There is a remotely exploitable buffer overflow vulnerability in a library function used by the CDE Subprocess Control Service. This vulnerability could be used to crash the service or to execute arbitrary code with root privileges. This vulnerability
is documented in VU#172583.
The Common Desktop Environment (CDE) is an integrated graphical user interface that runs on UNIX and Linux operating systems. The CDE Subprocess Control Service (dtspcd) is a network daemon that accepts requests from clients
to execute commands and launch applications remotely. On systems running CDE, dtspcd is spawned by the Internet services daemon (typically inetd or xinetd) in response to
a CDE client request. dtspcd is typically configured to run on port 6112/tcp with root privileges.
For more information about CDE, see
- http://www.opengroup.org/cde/ http://www.opengroup.org/desktop/faq/
There is a remotely exploitable buffer overflow vulnerability in a shared library that is used by dtspcd. During client negotiation, dtspcd accepts a length value and subsequent data from the
client without performing adequate input validation. As a result, a malicious client can manipulate data sent to dtspcd and cause a buffer overflow, potentially executing code with root privileges.
This vulnerability was first reported to us in March 1999, and more recently by Internet Security Systems (ISS) X-Force. For more information, see
- http://www.kb.cert.org/vuls/id/172583 http://xforce.iss.net/alerts/advise101.php
This vulnerability has been assigned the identifier CAN-2001-0803 by the Common Vulnerabilities and Exposures (CVE) group:
Many common UNIX systems ship with CDE installed and enabled by default. To determine if your system is configured to run dtspcd, check for the following entries (may be wrapped):
Any system that does not run the CDE Subprocess Control Service is not vulnerable to this problem.
- dtspc 6112/tcp
- dtspc stream tcp nowait root /usr/dt/bin/dtspcd /usr/dt/bin/dtspcd
An attacker can execute arbitrary code with root privileges.
Apply a patch
Appendix A contains information from vendors who have provided information for this advisory. We will update the appendix as we receive more information. If a vendor's name does not appear, then the CERT/CC did not hear from that
vendor. Please contact your vendor directly.
Limit access to vulnerable service
Until patches are available and can be applied, you may wish to limit or block access to the Subprocess Control Service from untrusted networks such as the Internet. Using a firewall or other packet-filtering technology, block or restrict access to the
port used by the Subprocess Control Service. As noted above, dtspcd is typically configured to listen on port 6112/tcp. It may be possible to use TCP Wrapper or a
similar technology to provide improved access control and logging functionality for dtspcd connections. Keep in mind that blocking ports at a network perimeter does not protect the vulnerable service from the internal network.
It is important to understand your network configuration and service requirements before deciding what changes are appropriate. TCP Wrapper is available from
Disable vulnerable service
You may wish to consider disabling dtspcd by commenting out the appropriate entry in /etc/inetd.conf. As a best practice, the CERT/CC recommends disabling any services that are not explicitly
required. As noted above, it is important to consider the consequences of such a change in your environment.
This appendix contains information provided by vendors for this advisory. When vendors report new information to the CERT/CC, we update this section and note the changes in our revision history. If a particular vendor is not listed below, we have not
received their comments.
Caldera Open Unix and UnixWare are vulnerable. Caldera has released Security Advisory CSSA-2001-SCO.30 (URL wrapped):
Case ID SSRT0782U
Compaq has not been able to reproduce the problem identified in this advisory for any Compaq OS. However, with the information available, we are including a code change for Compaq's TRU64 UNIX that will further reduce any potential overflow vulnerability.
This updated code will be announced when patches are available from the TRU64 UNIX FTP site and will be included in future releases of TRU64 UNIX. The TRU64 UNIX FTP patch site is at:
To subscribe to automatically receive future NEW Security Advisories from the Compaq's Software Security Response Team via electronic mail, use your browser select the URL:
Select "Security and Individual Notices" for immediate dispatch notifications directly to your mailbox. To report new Security Vulnerabilities, send mail to:
In April of 2002 Compaq released the following Security Bulletin (SSRTM541):
UNICOS, UNICOS/mk, and CrayTools are not vulnerable.
Fujitsu's UXP/V operating system is not vulnerable because it does not support any CDE components.
Hewlett-Packard has released Security Bulletin HPSBUX0111-175. Hewlett-Packard Security Bulletins are available at the IT Resource Center web site (registration required):
The IBM AIX Development and Security teams continue to examine the source code for CDE's dtspcd (sub-process control daemon). We have discovered that the fixes developed for this vulnerability three years ago are not effective
at closing this security hole. We have since developed emergency fixes and APAR assignments for AIX 4.3 and 5.1 to eliminate the vulnerability (once and for all!).
To receive the emergency fix, AIX SupportLine customers can call 1-800-CALL-AIX. The emergency fix ("CDE_dtspcd_efix.tar.Z") is posted for customer download at:
- For AIX 4.3, the APAR is IY25436
- For AIX 5.1, the APAR is IY25437
This efix also contains the efix for another buffer overflow in libDtSvc.a (efix "CDE_libDtSvc_efix.tar.Z", found in the FTP site given above). Thus, customers need only download and install this efix ("CDE_dtspcd_efix.tar.Z") to apply the two patches.
The Open Group maintains source code for the Common Desktop Environment (CDE). The Open Group is investigating this issue, and source licensees of The Open Group's CDE product can contact firstname.lastname@example.org
for advice regarding this issue.
SGI has released the following documents:
Sun has released Security Bulletin #00214:
Sun has also published Sun Alert Notification 41764:
Xi Graphics DeXtop 2.1 is vulnerable. Further information and a patch are available at the following locations:
- ftp://ftp.xig.com/updates/dextop/2.1/DEX2100.012.txt ftp://ftp.xig.com/updates/dextop/2.1/DEX2100.012.tar.gz
The CERT Coordination Center thanks Internet Security Systems (ISS) X-Force, who published an advisory on this issue.
Author: Art Manion
Copyright 2001 Carnegie Mellon University.
November 12, 2001: initial release, added workaround to disable vulnerable service
November 13, 2001: updated vendor information for HP
November 15, 2001: updated vendor information for IBM, Xi Graphics
November 16, 2001: updated vendor information for IBM
November 30, 2001: updated vendor information for SGI
December 17, 2001: updated vendor information for IBM
January 10, 2002: updated vendor information for Sun
April 3, 2002: updated vendor information for SGI
May 30, 2002: updated vendor information for Compaq